Good side effects. Deep classifiers would inevitably misclassify some inputs when tested on natural corruption data[1]}. Although no intentional perturbations are exerted on these samples, our MixDefense would still identify these misclassified samples as AEs. This is because there exist contradictions between the semantic meaning of the samples and the predicted labels, while the SP-defense layer ConraNet is designed to detect AEs with small perturbations based on such contradictions. See Section  for more details.
Though wrongly recognizing these misclassified samples as AEs, rejecting such samples would not decrease the accuracy of the target classifier and may even improve the classification accuracy [2]}.
